Stripe Inc. – Data processing regarding online payments

The payment service provider, in accordance with the contract concluded with the Ceph Assistant, participates in the execution of online payments, during which data transmission occurs to the online payment service provider during the purchase process. In this process, the online payment service provider handles the relevant billing name, address and the time of the purchase according to its own data processing rules.

The purpose of the data transmission is to provide the transaction data necessary for the payment operation initiated by the online payment service provider related to the purchase.

The legal basis for data transmission set out in Article 6(1)(b) of the GDPR, the performance of the contract between the User and Ceph Assistant, which includes the payment by the User. In case of online payments, the data transmission specified in this section is necessary for the payment.

SendGrid Inc. – Data processing regarding newsletters and automated letters

The data processor, in accordance with the contract concluded with the Ceph Assistant, participates in sending newsletters and automated letters to the Users. In this process, the data processor handles the name and email address of the Users to the extent necessary for the abovementioned purposes.

Billingo Technologies Zrt. – Data processing regarding invoicing

The data processor, based on the agreement with Ceph Assistant, participates in the record-keeping of accounting documents. In this context, the data processor handles the name and address of the data subject to the extent necessary for accounting records, in accordance with Section 169 (2) of the Accounting Act, for the specified period, after which it is deleted.

Contabo GmbH – Data processing regarding server hosting

The data processor, based on the agreement with Ceph Assistant, performs the storage of personal data. The data processor is not authorized to access personal data.

ADÓKA Gazdasági Tanácsadó és Könyvelői Bt. – Data processing regarding accounting purposes

The data processor, based on the agreement with Ceph Assistant, participates in the bookkeeping of accounting documents. In this process, the data processor handles the name and address of the User to the extent necessary for accounting records, in accordance with Section 169 (2) of the Accounting Act, for the appropriate period, and immediately deletes it thereafter.

Third parties: various organizations, whether affiliated or independent, determining the purposes and means of the processing of personal data, either individually or jointly with others. For example, Hungarian lawyers, auditors, and other authorities.

INTERNATIONAL DATA TRANSFERS 

We process your personal data in accordance with Hungarian data protection laws and transfer the data within the European Economic Area (‘EEA’) and outside the EEA to the United States. If we transfer your personal data outside the EEA, we take appropriate measures to ensure that your personal data is adequately protected, regardless of the country to which the data is transferred, in compliance with our legal obligations. Such a measure might be an EU Commission decision on data protection compliance or, for example, requiring and obtaining contractual commitment from any third party with access to personal data that ensures that your personal data receives at least the same protection as within the EEA. We provide a copy of the guarantees on request regarding personal data transferred outside the EEA, or if you need further information on these measures, please contact us at info@cephassistant.hu.

YOUR RIGHTS

You have the following rights in relation to our data processing:

• Right to information: We will take appropriate measures to provide you with the information on the processing of your personal data in accordance with Articles 13 and 14 of the GDPR and to provide you with the information in accordance with Articles 15 to 22 and 34 of the GDPR. You can request information about the processing of your personal data by Ceph Assistant by sending an email to info@cephassistant.com.

• Right to access:  you have the right to receive feedback on whether your personal data is being processed and, if such processing is ongoing, you also have the right to access your personal data and the following information: the purposes of the processing; the categories of personal data concerned; the recipients or categories of recipients to whom the personal data have been or will be disclosed; the period for which the personal data are stored; the rights that the data subject may exercise (rectification, erasure, objection, restriction of processing); the right to lodge a complaint with a supervisory authority; information on the data sources and the fact  of automated decision-making.

• Right to rectification: you have the right to have inaccurate personal data concerning you corrected or to request that incomplete personal data be completed. If you are unable to carry out these operations independently, you may request us to carry out these corrections by writing to us to info@cephassistant.com.

• Right to erasure: If you request it, we will erase personal data relating to you within 30 days of receipt of the request, if you request it on the grounds set out in Article 17(1) of the GDPR (e.g. the purpose of the processing has ceased; the data subject has withdrawn his or her consent and there is no other legal basis for the processing; the processing is unlawful; the data subject objects to the processing and there are no overriding legitimate grounds for the processing; the personal data must be erased on the basis of a legal obligation). Where there are grounds under Article 17(3) of the GDPR (e.g. processing is necessary for the exercise of the right to freedom of expression and information or for compliance with a legal obligation or for the establishment or defence of legal claims), we are entitled to refuse your request for erasure.

• Right to restriction of processing: if You contest the accuracy of personal data relating to you, you may request that we restrict the processing of your personal data while we verify its accuracy. You may also request restriction of processing if the processing is unlawful but you object to the deletion of the personal data or if Ceph Assistant no longer needs the personal data for processing but You require it to exercise your legal rights. You also have the right to request the restriction of processing if you have objected to the processing; in this case, the restriction will apply for the period of time it takes to determine whether Ceph Assistant’s legitimate grounds override your legitimate grounds. During the restriction period, personal data may be processed, except for storage, only in exceptional cases.

• Right to data portability: you have the right to obtain from Localme personal data concerning you  in  a  structured,  commonly  used,  machine-readable  format  and  to  have  such      data transmitted by you or, where technically feasible, by Localme to another controller, where the processing is based on consent or a contract and the processing is carried out by automated means.

• Right to object: You are entitled to object against processing your personal data at any time, for reasons related to your special situation; in this case it may be required from us to stop processing your personal data. Should you have the right to object, and you exercise it, your personal data will no longer be processed for such purposes. There is not any cost for exercising this right. You are not entitled to object, in particular if processing your personal data is necessary for pre-contractual steps or for the performance of an already signed contract.

• Right to complain: You can submit a complaint to the National Authority for Data Protection and Freedom of Information (1055 Budapest, Falk Miksa utca 9-11., phone number: +36-1-391-1400, e-mail: ügyfelszolgalat@naih.hu). Please note that pursuant to Article 37 of the GDPR, Ceph Assistant is not obliged to appoint a data controlling officer. Accordingly, further information on data protection may be available by reaching-out with Ceph Assistant directly through info@cephassistant.com.  

METHOD OF DATA PROCESSING, DATA TRANSFER, DATA SECURITY

We will not disclose your data to the public or to third parties without your prior written consent, unless we are required to do so by a court or administrative decision or by law, or if we disclose all or part of the performance of the activity to a third party.

Ceph Assistant shall not be liable to You or to any third party for any inaccuracy, misrepresentation, or omission of any personal data provided by You, unless we are required by law to verify the personal data. If any third party makes a claim against us in relation to the inaccuracy of the personal data provided, You will be responsible for satisfying that claim on behalf of Ceph Assistant. By providing us with your contact details, you also accept responsibility for ensuring that you are the only person communicating with us or using any services from the email address or telephone number you provide. Data subject is responsible for providing real and accurate information.

We do not provide information society services directly to children. The consent of children under the age of 16 to the processing of personal data is only lawful if the consent has been given or authorised by the person having parental authority over the child. The person giving the consent warrants that the consent complies with the above legal condition. If we become aware that consent to processing under the above provisions is unlawful, we will take immediate action to delete the personal data unless we have another legal basis for processing it.

Ceph Assistant will not transfer personal data of data subjects to third countries or international organisations. Ceph Assistant is not responsible for the disclosure, transmission, processing, sharing of personal data by users to third countries, which the users themselves have done of their own free will.

Ceph Assistant shall take all security, technical and organisational measures appropriate to the state  of the art and the cost of implementation, to the nature, scope, context and purposes of the processing and to the risk to the rights and freedoms of natural persons, in order to ensure the security of the data, to provide an adequate level of protection against unauthorised access, alteration, disclosure, deletion or destruction, accidental destruction or accidental damage and against possible loss of access.